From 0e11bd56b0c5b8050cf41842b7639b6bdf240bfb Mon Sep 17 00:00:00 2001
From: Rob Ede <robjtede@icloud.com>
Date: Sun, 9 Aug 2026 13:49:57 +0100
Subject: [PATCH 1/3] ci: add common zizmor workflow

---
 .github/workflows/lint.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 .github/workflows/lint.yml

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..7f1a19b
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,25 @@
+name: Lint
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: GitHub Actions Security
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          advanced-security: false
+          annotations: true

From 605018768d59c096d13705f96717150da6c046e6 Mon Sep 17 00:00:00 2001
From: Rob Ede <robjtede@icloud.com>
Date: Sun, 9 Aug 2026 13:53:58 +0100
Subject: [PATCH 2/3] fix: satisfy zizmor dependabot checks

---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ff58564..c045dc3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,11 +4,17 @@ updates:
     directory: /
     schedule:
       interval: monthly
+      cooldown:
+        default-days: 7
   - package-ecosystem: nix
     directory: /
     schedule:
       interval: monthly
+      cooldown:
+        default-days: 7
   - package-ecosystem: cargo
     directory: /
     schedule:
       interval: weekly
+      cooldown:
+        default-days: 7

From 45e3976046c7a7448c2034077b0dec21cc46a86e Mon Sep 17 00:00:00 2001
From: Rob Ede <robjtede@icloud.com>
Date: Sun, 9 Aug 2026 13:55:05 +0100
Subject: [PATCH 3/3] fix: correct dependabot cooldown placement

---
 .github/dependabot.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c045dc3..ce23503 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,17 +4,17 @@ updates:
     directory: /
     schedule:
       interval: monthly
-      cooldown:
-        default-days: 7
+    cooldown:
+      default-days: 7
   - package-ecosystem: nix
     directory: /
     schedule:
       interval: monthly
-      cooldown:
-        default-days: 7
+    cooldown:
+      default-days: 7
   - package-ecosystem: cargo
     directory: /
     schedule:
       interval: weekly
-      cooldown:
-        default-days: 7
+    cooldown:
+      default-days: 7